0

I’ve purchased a used laptop that should be arriving soon, and I’m wondering what best practices I can follow to make sure I wipe clean all the likely places any malware could be hiding.

I assume wiping the drives (one SSD and one HDD) and reinstalling Windows from a known-good ISO is a good first step. Should I also reflash the BIOS? Is there a way to check for hardware vulnerabilities? What order should I perform these important tasks? Are there any other vulnerabilities I’m over looking? Thank you!

  • This may be far too broad of a question. Who is your adversary and what are their resources? For the average malware, you just have to format the drive and reinstall. For anything sophisticated, even flashing the BIOS is not enough since you can still persist in the EC, HDD firmware, etc. Hardware modifications likewise can be made completely hidden. – forest Jul 26 '18 at 1:27
0

About the software side first:

Yes, absolutely wipe the disks.
It will defeat most malware (because most are simply not sophisticated enough to remain somewhere else ), ti helps the privacy of the previous owner, saves you some possible legal troubles because of software licenses and/or confidential data, etc.

Anf of course, you have clean and fast system, instead of all additional garbage that collected with long-term computer usage before; with the settings and softwares of your choice only.

About the "how" - it should go without saying that wiping is not deleting files in Windows. However partitioning and/or dd from /dev/zero isn't enough anymore either.

With eg. an Linux USB (or any other system capable of this) first wipe both disks eg. with dd from /dev/zero, and then for the SSD also run a "secure erase" eg. with hdparm. Because due to wear levelling etc., the dd only isn't enough there. Since it is a laptop (often without SATA hotplug capabilites) and many buggy USB connectors, it might be a bit tricky, but nonetheless recommended.


And the hardware ...

It depends who you want to protect against.
- The previous owner who was an average computer user?
- State-level actors, HW vendors, and technical people capable of actually writing BIOS malware etc., who might have done something while (or before) the previous owner was using the computer?

For the first:
- Per definition above, these people are not capable of doing much. Maybe able to buy a keylogger in the internet, but else...
- Yes, flash the BIOS. Not so much because of malware, but just to have an update.
- Make sure that, if you have Intel ME/AMT, that it is at least disabled completely. If you don't need it, I'd recommend using me_cleaner to get rid of it as much as possible. (In case you dont know what ME is, this "feature" allows full remote control of the computer, even when turned off (but with power). Of course the intended usage is that unauthorized people get no access. However the previous owner might have configured access for himself, and furhtermore there are several known security bugs).
- If you want, open the computer and identify what each part is for. Eg. a small black box plugged in between keyboard and mainboard might save your typed passwords and probably shouldn't be there...

For the other group: If you think they might have done something with this computer (and something they don't do to all computers in your country etc.), then do not use it.
Even with all technical knowledge of the world, searching "something" they could have done would be searching a needle in a haystack. It isn't worth the effort. And of course we don't have "all" knowledge either.

Jus to address the BIOS / mainboard firmware: Updating it per software is useless against malware in it, because updating requires the cooperation of the mainboard (of course). If there exists some malware already, it just could say "ok, update finished" without actually replacing the infected parts.
As the relevant data usually is in a distinct device on the mainboard, changing it with proper hardware is better (as the turned-off mainboard can't prevent it). However, even if you find someone to do that, it's just one of very many possible attack vectors, so...

Related example: Devices like hard disks, network cards and CPUs have their own firmware. What about these? Right, you would have to replace them too (because of this cases, the next computer repair shop too has no tools anymore to force in clean data). And then you can replace everything and end up with a new computer.

  • It's a tired myth that the ME allows full control of a computer even when off. That's only true if you explicitly configure it to do so and, in some cases, even register it with Intel. It will not and cannot do that by default on a consumer (non-enterprise server) system. It's still a good idea to kill the ME though, simply to avoid the bugs it can come with. – forest Jul 26 '18 at 1:30
  • @forest ... did I ever say it was default? No. On the contrary, I explicitly mentioned that the owner might have configured it to get access. – deviantfan Jul 26 '18 at 1:32
  • That's why I just wrote a comment without a DV. I just think it might be a good idea to be more clear so as not to risk spreading this myth. The issue is that it's AMT software that makes that possible, not the ME (which, in the majority of systems, can't be configured to do this even intentionally). – forest Jul 26 '18 at 1:39
  • By the way, now we have 3 answers in a row where you say it's wrong / myth / whatever because (in my opinion) not reading properly... – deviantfan Jul 26 '18 at 1:40
  • If that's true, then I apologize and should probably read more (I'm not sure which ones those are. I still stand by my critique of the crypto answer wrt XTS and wide block ciphers). I'm just so used to seeing people spread various myths that I get overly agitated about it. Might not be the best time for me to point out that CPUs don't have persistent firmware since microcode is just a table. ;) – forest Jul 26 '18 at 1:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.